code17fandomcom-20200215-history
Code 17 Wiki
Welcome to the Code 17 Wiki A Community dedicated to decode Syrapt0r's riddles What? Where? Why? Syrapt0r is a german game developer and music producer. He is currently producing a new game and constantly updates his website with riddles. Here are some of the most useful links: Trivia (so far...) A curate list of Sysrapt0r's riddles and hints * syrapt0r.nulldev.org just featured the text "Construction" * Realese of DROP's ludum dare version * The site syrapt0r.nulldev.org/code17 just displayed some hexadecimal values with statements such as "Finished", "Running" and "Redacted". Also the sentence "What? He just... restarted this thing? Is he insane? Does he remember what happened last time?" which could be a reference to one of the log files covered later. * In syrapt0r.nulldev.org/code17/logs there are two log files. "log_0000000000.txt" and "log_1238784103.txt". The content of the files is the following: * syrapt0r.nulldev.org now displays "Hide" which then dissapears and is followed by "He comes" and a countdown. It counts to the date Aug 1, 2018 00:00:00. * A new link was discovered: syrapt0r.nulldev.org/drop-game. It displayed nothing but "There is nothing here... yet...". "Drop" was the name of Syrapt0r's game for Ludum Dare. * A new log file with the title "my final note.txt" appeared on syrapt0r.nulldev.org/code17/logs. By the time it appeared, it was impossible to decode. It's content can be seen here: * The HTML comment "" appeard on syrapt0r.nulldev.org/code17. * A new file called "a very deep sound.wav" was linked on syrapt0r.nulldev.org/code17. The name of the link was "is this it?". This file needed to be opened with the Program DeepSound which then revealed an image called "key.png". This image looked like that: The QR code decoded led to the string: "YRG HSRUG VEVIBGSRMT URUGB GRNVH". Converting the numbers in the picture from Decimal to Base64 resulted in "QCArIC9iaW4vPw ". When decoded, it revealed the string "@ + /bin/?". This is a hint for "atbash" (@ + /bin/bash -> @ + bash) which is a cipher. When decoding the QR Code string with an Atbash cipher, it revealed "bit shift every thing fifty times". Bitshifting the "my final note.txt" text by 50 bits finally revealed the content of it: The code of the decoder written by NullDev can be found here: https://gist.github.com/NLDev/2eaf597a57cbaace7c0a279ec783bca1 * The text on syrapt0r.nulldev.org/code17 changed from "It is wrong" to "It is over" * New text appeared on syrapt0r.nulldev.org/code17 "I am still here". It was hidden on the bottom. * syrapt0r.nulldev.org/code17 is displaying a new text now: "It is never over. A circle does not have an ending." and a hidden text: "Backup of ./backup failed. Please check your backup configuration.". When navigating to "./backup" (syrapt0r.nulldev.org/code17/backup) a file called backup.zip can be found. This ZIP contains 4 files: "log_481290481.txt", "MNTS.zip", "notes.txt" and "secret.txt" with the following contents: The file MNTS.zip is password protected and contains 3 more files: "mus_level.ogg", "mus_mainMenu.ogg" and "RUN.exe". * When decoding the string in secret.txt from Hexadecimal to ASCII, a link is revealed: https://pastebin.com/M6FtQtm4 The link leads to very long base64, which when decoded, revealed an image: * The name "Claire" is visible which in upper case ("CLAIRE") is also the password to the MNTS.zip file. * RUN.exe is a game. Fist a booting stcreen is visible. Then a main menu. There are two levels. In the first one you have to collect 9 coins for a wall to disappear. Then you can go through a door. In the second level you need to collect 5 coins. When you then reach the exit, the text "Thanks for playing appears". However there is a secret: In the first level on the very right, a wall is blinking. Go through it and the game crashes with the following error message: * A new folder appeared on syrapt0r.nulldev.org/code17/logs - "mnts". In it, there is a file called "mnts_log_01.txt". Contents: * When decoding the Binary part in the section "APPEND I" to ASCII, a message is revealed: PLEASE GET ME OUT OF HERE TELL ME YOU CAN HEAR ME HELP ME HELP ME HELP ME HELP ME HELP ME HELP ME HELP ME HELP ME * A new Log File with the word "FOUND" in it appeared on syrapt0r.nulldev.org/code17/logs/mnts mnts_log_02.txt: 0000000000 ###################### ###################### ###################### ###################### ###################### #####################F OUND * Syrapt0r uploaded a video to his youtube channel "TRANSMISSION ONE": https://www.youtube.com/watch?v=djD2LwwozZ8 The video description features the text "aHR0cHM6Ly9zeXJhcHQwci5udWxsZGV2Lm9yZy9jb2RlMTcv". This is Base64. When decoded it leads to the URL https://syrapt0r.nulldev.org/code17/ * There is a new text on syrapt0r.nulldev.org/code17: "How long did you expect me to stay quiet, my old friend?" as well as a new link "See for yourself." leading to https://syrapt0r.nulldev.org/code17/mntsshell.exe * There is a new log file in syrapt0r.nulldev.org/code17/logs When Decoding the string after "see", a link is revealed: https://en.wikipedia.org/wiki/MD5 * There is another new log file. This time in syrapt0r.nulldev.org/code17/logs/mnts Currently there are three log files in syrapt0r.nulldev.org/code17/logs/mnts: mnts_log_03.txt and mnts_log_04.txt appear to be missing. * When opening mntsshell.exe from https://syrapt0r.nulldev.org/code17/mntsshell.exe you are prompted with a login. See below The username is obvious. Its "nathan" as seen in pw.txt ''from above. The password was a bit more difficult. From the text ''"claire needs to see https://en.wikipedia.org/wiki/MD5" ''it's clear that the password has to be a MD5 hash. The text in pw.txt could be read as "claire (''need to see https://en.wikipedia.org/wiki/MD5)". So the password would be the MD5 hash of the word "claire". The hash of the name is 182e500f562c7b95a2ae0b4dd9f47bb2 and this was actually the password. Screenshot of the shells functions: * The value next to "HEART RATE:" appears to vary. This could indicate that the session is monitored live and the subject is currently living. * There is a new link on https://syrapt0r.nulldev.org/code17 called "LOG IN". It leads to http://syrapt0r.nulldev.org/code17/login/login.html * In the same directory as the login.html script, there are a bunch of other files: The only interesting file here is "BACKUP.jpg". login.html just redirects to login.php once the user entered a code on the page: A wrong input just redirects to login.php with the text "Code not recognized. Please try again." The rest of the files are just Fonts and Styles. From the HTML code of the page: This gives us the hints, that the code must not exceed 23 characters and is always upper-case. It led to the conclusion that its the 23 character long code at the bottom of the BACKUP.jpg picture: BACKUP.jpg: Plain text version of the image (yes, I actually typed that by hand...): 01011011 01000010 01000101 01000111 01001001 01001110 00100000 01010100 01010010 01000001 01001110 01010011 01000011 01010010 01001001 01010000 01010100 01011101 00100000 01001001 01110100 00100000 01101001 01110011 00100000 01101001 01101110 00100000 01101111 01110101 01110010 00100000 01101000 01100101 01100001 01100100 01110011 00101110 00100000 01001001 01110100 00100000 01101001 01110011 00100000 01100100 01110010 01101001 01110110 01101001 01101110 01100111 00100000 01110101 01110011 00100000 01101001 01101110 01110011 01100001 01101110 01100101 00101110 00100000 01010000 01101100 01100101 01100001 01110011 01100101 00100000 01100110 01101001 01101110 01100100 00100000 01110011 01101111 01101101 01100101 01101111 01101110 01100101 00101110 00100000 01010000 01101100 01100101 01100001 01110011 01100101 00100000 01101000 01100101 01101100 01110000 00100000 01110101 01110011 00101110 00100000 01010000 01101100 01100101 01100001 01110011 01100101 00100000 01101000 01100101 01101100 01110000 00100000 01101101 01100101 00101110 00100000 01010000 01101100 01100101 01100001 01110011 01100101 00101110 00100000 01001001 01100110 00100000 01110111 01100101 00100000 01100100 01101111 01101110 00100111 01110100 00100000 01101101 01100001 01101110 01100001 01100111 01100101 00100000 01110100 01101111 00100000 01110011 01110100 01101111 01110000 00100000 01110100 01101000 01101001 01110011 00100000 01110110 01100101 01110010 01111001 00100000 01110011 01101111 01101111 01101110 00101100 00100000 01101000 01100101 01110010 00100000 01101001 01101110 01100110 01101100 01110101 01100101 01101110 01100011 01100101 00100000 01110111 01101001 01101100 01101100 00100000 01101110 01101111 00100000 01101100 01101111 01101110 01100111 01100101 01110010 00100000 01100010 01100101 00100000 01100011 01101111 01101110 01110100 01100001 01101001 01101110 01100101 01100100 00100000 01101001 01101110 00100000 01110100 01101000 01101001 01110011 00100000 01100110 01100001 01100011 01101001 01101100 01101001 01110100 01111001 00101110 00100000 01010100 01101000 01101001 01110011 00100000 01100011 01101111 01110101 01101100 01100100 00100000 01110100 01110010 01101001 01100111 01100111 01100101 01110010 00100000 01100001 00100000 01110011 01100101 01100011 01101111 01101110 01100100 00100000 01110011 01101001 01101110 01100111 01110101 01101100 01100001 01110010 01101001 01110100 01111001 00101110 00100000 01010111 01100101 00100000 01101110 01100101 01100101 01100100 00100000 01110100 01101111 00100000 01100111 01100101 01011011 01000101 01001110 01000100 00100000 01010100 01010010 01000001 01001110 01010011 01000011 01010010 01001001 01010000 01010100 01011101 CC7E4-DE880-C8104-XCD49 * The binary text translates to: TRANSCRIPT It is in our heads. It is driving us insane. Please find someone. Please help us. Please help me. Please. If we don't manage to stop this very soon, her influence will no longer be contained in this facility. This could trigger a second singularity. We need to geTRANSCRIPT * The password to the login page is actually the code from the bottom of the binary text (CC7E4-DE880-C8104-XCD49). Once entered, the message "How many As are in BACKUP?" appears. * The counter on http://syrapt0r.nulldev.org now counts to the date Oct 1, 2018 00:00:00 instead of Aug 1, 2018 00:00:00 * Counter is back to Aug 1, 2018 00:00:00. Was probably just a mistake * The code17 site displays nothing but "Rebooting..." * The code17 site has a green text saying: "THE END - Thank you for your cooperation, subject #991452. Expect your results shortly." and a footer saying "© 1974 Orbyt Inc." Category:Browse * The page now shows an orange text: You have completed experiment #17. Please move on to experiment #18. * There is a new site: https://syrapt0r.nulldev.org/code18 It shows a video of which appears to be the footage of an CCTV camera